CIAM vs IAM: What's the Difference?
Workforce IAM (Identity & Access Management) and CIAM (Customer Identity & Access Management) sound like the same thing. They're not. Using one in place of the other is one of the most expensive mistakes we see.
IAM: Built for Employees
Workforce IAM (Entra ID, Okta Workforce, Ping) is optimised for a known, finite population that your IT team controls:
- Accounts are provisioned by HR
- Strong MFA is mandatory
- Conditional access enforces device, location, and risk policies
- Lifecycle ends when someone leaves
The user has no say in being onboarded — they have to use it.
CIAM: Built for Customers
CIAM (Entra External ID, Azure AD B2C, Auth0, Okta Customer) optimises for unknown, untrusted, self-service users at internet scale:
- Users sign themselves up
- Social and passwordless logins reduce friction
- Branding looks like your product, not Microsoft
- Progressive profiling collects data over time
- Consent, GDPR, and data residency are first-class
If signup friction loses you 5% of conversions, that's revenue — not an IT ticket.
The Five Differences That Actually Matter
| Dimension | IAM | CIAM | |---|---|---| | Scale | Thousands | Millions | | Onboarding | IT provisions | User self-serves | | Branding | Corporate | Per-product, white-label | | Authentication | MFA mandatory | Friction-aware | | Data model | HR is source of truth | Consent + progressive profile |
Why Mixing Them Backfires
Putting customers into your workforce tenant means:
- Your conditional access policies will block them
- Your licensing costs explode
- Your IT team becomes customer support
- A breach in your customer base touches your employee directory
Putting employees into a CIAM tenant means losing the security guardrails IT depends on.
Microsoft's Modern Stack
- Entra ID for workforce
- Entra External ID for customer (the successor to Azure AD B2C)
Both run on the same platform under the hood, but the tenants, policies, and user experiences stay separate — which is exactly what you want.
How to Choose
Ask one question: does the user choose to sign up, or are they assigned?
- Assigned → IAM
- Chooses → CIAM
If you have both populations, run both — separately.